Bug Report

Problematic behavior

The access API endpoint returns for each user the abilities, means the current user actions available for the targeted user. The front application does not respect these abilities and implements its own business logic leading to an inconsistent behavior between the front and the back application. This can be consider as a security risk as it is possible to change the roles bypassing the front application and using directly the API.

Expected behavior/code

The front application should build the roles select box and delete button based on the abilities present in the response of the access endpoint

Steps to Reproduce

1. Create a new document
2. Invite someone as an owner
3. Try to downgrade the role to administrator, the select box warn you is it not possible
4. Inspect the response of the access endpoint, in the abilities.set_to_role you have all the roles this user can be changed to.

Environment

• Impress version: v3.1.0

Possible Solution

Use the abilities return by the API.